Cloud Foundry CAPI CVE-2026-59388

Exploitation requires an authenticated actor (PR:L) able to read CAPI audit events, plus the occurrence of the specific operations that leak secrets: app manifest application/creation/update (exposes custom buildpack credentials and service binding parameters), user-provided service instance operations with a syslog drain URL (exposes drain URL credentials), and service binding audit events (exposes binding parameters). The exposure is passive - secrets are written into audit records regardless of attacker action - so the limiting factor is access to those audit logs rather than any crafted payload; there is no remote unauthenticated path and no code execution or data modification capability. Realistic risk is bounded by how broadly audit-event read access is granted in the deployment.

This is a genuine but moderate-priority information-disclosure issue (CVSS 6.5), not an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N shows a network-reachable, low-complexity flaw that requires some authenticated privilege (PR:L) and yields high confidentiality impact with no integrity or availability impact - consistent with secrets leaking into logs rather than code execution. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the absence of active exploitation. There is no CISA KEV listing and no EPSS score was provided, so exploitation probability cannot be quantified from the input; no public exploit reference is present either. The confidentiality-only impact is real because the leaked material is credentials (custom buildpack credentials, syslog drain URL credentials, and service binding parameters), but realization depends on an attacker already having authenticated access sufficient to read the relevant audit events. CWE is not provided in the input. Net: a legitimate credential-exposure defect worth patching within the normal cycle, not a drop-everything incident.

An authenticated Cloud Foundry user or operator with the ability to read audit events observes app manifest, app creation/update, service binding, or user-provided service instance audit records and finds custom buildpack credentials, syslog drain URL credentials, or service binding parameters written in cleartext. They harvest these secrets and reuse them to access the backing services or buildpack sources. No public exploit code is identified at time of analysis; the trigger is simply performing or reading the normal operations that CAPI audit-logs insecurely.